troubleshooting

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

When configuring an IPsec tunnel using IKEv2, which THREE parameters are commonly negotiated during Phase 1?

You are managing FortiGates across multiple ADOMs. How can you share common firewall objects (e.g., mail servers, common IP ranges) across these ADOMs?

Which command allows you to view the current routing table for a specific VDOM?

Which TWO options are available when configuring an SD-WAN rule in FortiManager?

A network administrator is configuring SSL inspection for a group of users. Which certificate must be installed on the client endpoints to prevent browser certificate warnings?

What is the purpose of the 'Gateway' override in an SD-WAN member configuration?

Which TWO methods can be used to update SD-WAN policies across all managed devices in FortiManager?

You are deploying a new SD-WAN interface. What is the mandatory step before you can add an interface to an SD-WAN zone?

An administrator is migrating a standalone FortiGate into an existing FortiManager. What happens to the existing firewall policies on the FortiGate during the import process?

Which TWO methods are used to achieve traffic separation in a multi-VDOM environment?

When configuring an SD-WAN rule for a specific application, how does the FortiGate identify the traffic?

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

When configuring SD-WAN in FortiManager, why would you use 'Shared Objects'?

A network administrator needs to provision a new SD-WAN zone across 50 managed FortiGates using FortiManager. The administrator wants to minimize manual configuration and ensure that the SD-WAN settings remain consistent. Which FortiManager feature should be used to achieve this?

What happens if you modify an SD-WAN template that is already applied to a FortiGate?

What is the effect of changing the IPS 'buffer' size on a FortiGate device?

An administrator notices that logs are not appearing in FortiManager for a specific FortiGate. What is the first thing to check to ensure log forwarding is active?

When using SD-WAN, how does the 'member' configuration interact with physical interfaces?

You need to inspect traffic between two VDOMs. Which mechanism is required?

What is the benefit of using 'CLI Templates' in FortiManager?

A FortiGate is performing OSPF routing. You want to redistribute connected routes into OSPF, but only for a specific subnet. How can this be achieved?

In SD-WAN central management, what is the 'SD-WAN Zone' used for?

Which component of FortiManager allows for the centralized management of firmware across multiple devices?

When viewing the SD-WAN Monitor in FortiManager, what information is provided for the 'Health Check' status?

Which THREE of the following protocols can be used for Performance SLA probes?

Which parameter, when modified in a policy, causes a session flush for all active connections hitting that policy?

When using SD-WAN zones, what is the primary benefit of grouping multiple physical interfaces into a single zone?

How can you verify that an SD-WAN configuration change was successfully applied to a FortiGate via FortiManager?

Which SD-WAN rule strategy should you choose if you want to distribute traffic across multiple interfaces based on their bandwidth weights?

Which THREE pieces of information are displayed in the SD-WAN Monitor in FortiManager?

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 1 comes up successfully, but Phase 2 fails. You have verified that the pre-shared keys match and the proposals are identical. What is the most likely cause?

Which TWO of the following are benefits of using SD-WAN templates in FortiManager?

An administrator wants to use FortiManager to push a configuration change to 50 FortiGates simultaneously. Which method minimizes downtime and ensures consistency?

An administrator needs to perform a firmware upgrade on 100 FortiGates. Which feature in FortiManager allows this to be done securely with a rollback option?

Which TWO components are synchronized between HA members?

What is the impact of checking the 'Interface Preference' box in an SD-WAN rule?

What is the purpose of the 'Inbound' interface setting in an SD-WAN rule?

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Which interface can be used as an SD-WAN member in an SD-WAN template?

What is the default behavior of a FortiGate firewall policy when no explicit policy matches the traffic?

Which FortiGate feature should be enabled to prevent internal users from accessing malicious websites based on real-time threat intelligence?

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

What is the result of 'Pushing' a policy package from FortiManager to a FortiGate?

If an SD-WAN template contains a reference to an interface that does not exist on a target FortiGate, what occurs during the installation process?

Which THREE of the following are mandatory for a BGP neighbor adjacency to establish?

You need to inspect traffic between two internal VLANs. How do you ensure this traffic is processed by the FortiGate?

You are configuring an IPS policy to protect a web server. You notice that traffic is being dropped due to a false positive. Which action is the most efficient way to resolve this while maintaining security?

Which TWO methods can be used to authenticate a FortiGate when it registers to a FortiManager?

What is the default behavior for 'override' in FortiGate HA?

You are configuring BGP and need to advertise a summary route to your ISP. How do you ensure only the summary route is advertised?

Which THREE of the following are parameters that can be monitored in a Performance SLA?

What is the effect of changing the 'Hold-down' timer in a Performance SLA?

What is the impact of changing the 'set vdom-mode' from 'no-vdom' to 'multi-vdom'?

When using SD-WAN templates, how are SD-WAN rules ordered?

Which object must be created before assigning a health check to an SD-WAN service rule in an SD-WAN template?

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

When creating an SD-WAN template, what must be defined before you can add an SD-WAN interface to the template?

What is required before FortiManager can display SD-WAN monitoring data?

When setting up a Performance SLA, what is the 'Participant' setting?

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Which TWO of the following are necessary to successfully deploy an SSL VPN in tunnel mode?

A FortiGate is operating in transparent mode. What is the default behavior when the device receives a frame with an unknown MAC address?

If you modify a shared SD-WAN health check object that is referenced by ten different templates, what happens to the FortiGates?

What is the maximum number of members allowed in a single SD-WAN zone?

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

During SD-WAN template deployment, what is the role of 'Dynamic Mapping'?

Which TWO administrative actions require a 'Workspace Mode' enabled in FortiManager?

When using SD-WAN templates, which option allows you to manage different ISPs on different branches within the same template?

Which TWO actions can be performed on a Revision History item in FortiManager?

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

Which configuration mode allows you to define a virtual MAC address for an HA cluster to prevent ARP cache issues on switches?

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Which THREE of the following criteria are used for SD-WAN rule traffic matching?

You are troubleshooting a policy installation failure where the FortiManager reports a 'Configuration conflict'. Which action should you perform to identify the root cause of the mismatch?

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

You notice that an IPsec tunnel is up, but no traffic passes. What is the most common reason related to firewall policy configuration?

You are troubleshooting high CPU usage on a FortiGate. Which process would you check to see if the IPS engine is the cause?

Which TWO of the following are benefits of using the FortiGate flow-based inspection mode?

What is the primary function of the FortiGate Security Fabric?

Which TWO of the following are valid methods for user authentication on a FortiGate?

Which THREE items are included in the configuration file of a FortiGate?

When using an IPS sensor, what is the difference between 'Protect' and 'Monitor' mode?

Which TWO types of reports can be generated in the FortiAnalyzer module of FortiManager?

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Which TWO settings are modified to reduce the impact of a failover event in an HA cluster?

Which TWO of these are valid SD-WAN health check protocols?

You are using 'SLA Target' as your strategy. What happens if multiple members meet the SLA?

When adding a FortiGate to FortiManager, which mode must the FortiGate be in to allow the FortiManager to manage its configuration and policies?

Which THREE aspects of the FortiGate system are affected by changing the global 'set vdom-mode' to 'multi-vdom'?

Which THREE items are included in a Policy Package when it is pushed from FortiManager?

In a VDOM-enabled environment, how are administrative accounts managed?

What is the primary purpose of an ADOM in FortiManager?

You are troubleshooting an issue where traffic is not using an SD-WAN rule despite meeting criteria. What is the most likely cause?

When configuring SD-WAN services in a template, what does the 'Performance SLA' setting determine?

You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

Which command is used to verify the current status of SD-WAN members and their SLA health from the CLI?

Which FortiGate feature is used to group multiple physical interfaces for redundancy at Layer 2?

Which protocol is NOT a valid option for Performance SLA probes?

Which TWO criteria can be used in SD-WAN rules to select an outgoing interface?

Which TWO of the following can be used as a 'Source' in an SD-WAN rule?

Where are SD-WAN zones managed in the FortiGate GUI?

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Which TWO actions should be taken when preparing to upgrade a FortiGate HA cluster?

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

How do you apply an SD-WAN template to multiple managed FortiGates simultaneously?

An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?

Which THREE factors influence log storage efficiency on a FortiAnalyzer/FortiManager?

Which feature in FortiManager allows you to monitor SD-WAN performance across all managed FortiGates?

You are setting up an SD-WAN configuration via FortiManager. Which object type is used to group multiple WAN interfaces for SD-WAN member assignment?

What is the purpose of the 'Any' interface in a firewall policy?

Where can an administrator check the status of the connection between a FortiGate and FortiManager?

In a site-to-site VPN, you need to allow traffic initiated from the remote site. What configuration is essential on the local FortiGate?

When configuring an SD-WAN rule, what is the purpose of the 'Source' address field?

You want to automate the onboarding of new FortiGate units. Which FortiManager feature allows you to pre-configure devices before they connect to the network?

What is the purpose of 'dedicated HA' interfaces?

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

What does the 'FortiGuard' service provide to the FortiGate?

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

What does the 'set tcp-rst-timeout' command control?

You are configuring SD-WAN templates in FortiManager. What is the primary purpose of using SD-WAN Central Management instead of configuring SD-WAN directly on individual FortiGates?

What is the benefit of using 'SD-WAN Zones' in templates when managing 100+ branches?

Which THREE types of traffic are typically NOT offloaded by the NP6 processor?

Which THREE factors can affect the 'Performance SLA' logic in an SD-WAN template?

You want to standardize the SD-WAN configuration for 50 remote branch offices. Which FortiManager feature should you use?

A network administrator is configuring an HA cluster with two FortiGates in Active-Passive mode. Which parameter must be identical on both devices to ensure a successful cluster formation?

Which THREE steps are involved in the 'Policy Package Installation' workflow?

You have a large SD-WAN deployment. Why would you use a 'Centralized Policy' in FortiManager instead of local policies?

In a complex VPN scenario with NAT-Traversal (NAT-T) enabled, what is the primary purpose of the UDP 4500 port?

You are implementing SSL VPN and need to ensure that only compliant corporate laptops can connect. Which feature should you use?

Which method is the most secure for managing FortiGate devices remotely?

You have an SD-WAN rule with 'Priority' strategy. What happens if the highest priority member fails its SLA?

You are configuring an IPsec VPN tunnel between two FortiGates. Phase 2 fails to come up. What is the most likely cause?

An administrator has applied an SD-WAN template to a FortiGate managed by FortiManager. Later, the administrator modifies the template by adding a new SD-WAN member and installing the configuration. What is the expected outcome on the FortiGate?

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

Which TWO of the following can be used to optimize IPsec VPN performance?

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

Which THREE tasks are required to successfully deploy SD-WAN via FortiManager?

An administrator needs to provide access to FortiManager for a junior team member who should only be able to view logs and reports. Which feature is used to define this access?

Which TWO of the following steps are required to correctly configure a Performance SLA?

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Which TWO items must be configured within an SD-WAN template for SD-WAN traffic steering to work?

You need to ensure that VoIP traffic stays on the interface with the lowest jitter. Which strategy should you use?

Which THREE items can be managed via Device Templates in FortiManager?

Which TWO configuration changes require a push from FortiManager to the FortiGate?

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

Which THREE types of traffic are typically inspected by an IPS policy?

Which TWO of the following can cause an SD-WAN member to be marked as 'down' in an SLA?